Tivoli Storage Manager Installing the Clients


Appendix C. TSM Web Client Secure Socket Layer

When TSM administrators sign onto the TSM server, using the TSM administrative Web interface client, they provide a user ID and password. The TSM server generates a security token for this user ID, and this token is used to verify the TSM administrative Web interface each time it issues a command to the TSM server. The security token is encrypted, and expires after a certain period of time. When the TSM administrator, after signing onto the TSM server, hyperlinks to the Web backup-archive client, the security token is passed to the Web client and is used to authenticate the user ID. Since this token permits the user access to the client, the Web client provides the user the option to securely pass this information from the administrative Web interface to the Web client using the HTTPS protocol.

HTTPS is simply the HTTP protocol transmitted over a secure socket layer. If your TSM administrators are hyperlinking to client machines to use the Web client, and you need to protect the security token when it is transmitted over the network, then you should configure the Web client for SSL so that the HTTPS protocol can be used.

The following sections contain information that will help you manage SSL communications:

To support SSL, the TSM install package includes utilities to create and maintain certificates. The SSL communications is only supported on AIX, Windows 95, Windows 98, and Windows NT. You can use the Make Key File utility (MKKFE) to create public-private key pairs and certificate requests, receive certificate requests into a key ring, and manage keys in a key ring. MKKFE prompts you for the necessary information. Optionally, after you have created a certificate request, you can send it to a Certificate Authority (CA) to have it signed.


Configuring SSL Communications

This section describes the following tasks for setting up TSM to use SSL:

Creating a Key Pair

To create a public-private key pair, request a certificate, receive it into the key ring file, and:

  1. Enter mkkfe to start the utility.
  2. Enter n to create a new key ring file. The key ring file is used to store one or more key pairs and certificates.
  3. Name the file certkey.kyr. The TSM Web client will not recognize any other name.

Requesting a Certificate

To request a certificate:

  1. Select w from the main menu to work with certificates.
  2. Select c to create a new certificate. Enter apollo at the password prompt. This is the password for the key ring file. The TSM Web client does not recognize any other password. After the password is entered twice, a prompt asks if the password will expire; answer no.
  3. Press s to create a PEM certificate. A request for certificate information displays.
  4. Press m to modify the request for certificate information. You can enter the information requested in each field or leave the field blank by pressing Enter.
    Note:
    • When prompted for the key entry name, type TSM Web Client.
    • The second entry is for the key size. The recommended key size is 512.
    • When prompted for the server's fully qualified TCP/IP domain name, be sure to enter the TCP/IP domain name where the TSM client is installed.
  5. Press r to create the certificate request. When prompted for a file name, type certreq.txt.
  6. Press x from the Key Menu to return to the Key Ring Menu.

Receiving the Certificate into the Key Ring

To receive the certificate into the key ring:

  1. Press r from the Key Ring Menu. Enter certreq.txt which is the filename of the certificate. If you receive a warning about the certificate being self-signed, enter yes to add it to the key file.
  2. Press w to work with the certificate
  3. Press l to list and select the certificate. Press n to navigate down the list until you find TSM Web Client, and press s to select it.
  4. Press x to return to the Key Ring Menu.
  5. Press f to make the certificate the default certificate.
  6. Press s to save the Key Ring. You may be prompted if the file already exists; it is OK to overwrite this file.
  7. Press x to exit MKKFE

Configuring Web Client for SSL

After the certificate is created and received into the key ring file, copy the key ring file, certkey.kyr, to the TSM client installation directory. Before bringing up the TSM Client Acceptor, set the httpsport option, see Httpsport for more information. This indicates that the client should bring up the SSL communication method.

Set the NLSPATH environment variable as follows:

Start the TSM Client Acceptor using one of the following procedures:

The client starts the initialization of the SSL communication method.

You can access the TSM Web client using the SSL communication method with any browser that is Java1.1.6-capable by entering the following URL:

https://your_machine_name:httpsport_number

where your_machine_name is the hostname of the machine running the TSM Web client with the SSL communication method, and httpsport_number is the port number you specified using the httpsport option, see Httpsport for more information.

The Web client workstation can also be accessed through the TSM system administrative GUI.

You will receive warning messages from the Web browser the first time you connect to the client machine. This is because the certificate that you created is not trusted by the browser. Each browser handles the matter differently. Netscape permits you to receive the certificate as a Web site certificate. The received certificate is then compared with the certificate sent by the TSM client every time you connect the server. After setup completes, you are not prompted for more information if you click the Always accept bullet in the wizard. The Internet Explorer prompts you if the received certificate is not trusted. You will receive this message every time you connect to the TSM client, unless you turn the warning message off.


[ Top of Page | Previous Page | Next Page | Table of Contents | Index ]